William Harris
William Harris is an alias
that 7 published sources report
in connection with IT Worker Fraud activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from Kawaii Jong UwUn (@KawaiiJongUwUn) and Chollima Hunter.
The earliest of those reports is dated 2025-08-09 and the most recent 2026-09-20.
The reporting files it under the persona William Harris, alongside 23 other identifiers attributed to the same identity. The persona page shows them together with any accounts, photographs and CV recorded under that name. A persona name is the one an account presented under, and may belong to an uninvolved person whose identity was taken.
alias IT Worker Fraud CURATED
Sources
-
Two persona names sharing one Telegram handle, silvani777, and one LinkedIn slug, with a Skype id and a phone number given for each; the chart links the identity to Liu Jian Hua and, with a question mark, to an ungrouped GitHub account silvani214 as possibly the same Silvani. Transcribed from the researcher's chart, which groups every account under the name it gives here and draws its links from mutual follows, shared contact details and repositories carrying one another's details. The chart also gives Discord handle santiagourregobotero_61780, for which this site has no extractor. Accounts on platforms this site does not index, as the chart lists them: stackoverflow.com/users/20988762/william-harris, cake.me/me/santiago-urrego-botero?locale=fr, stackoverflow.com/users/22406929/santiagourregobotero, rocketreach.co/santiago-urrego-botero-email_724489933, awstip.com/overlay-with-own-url-in-react-b579286f5db4.
github.com/Kawaii-Jong-UWUn/ITW-Cluster-Research/tree/main/EliteCoder — Kawaii Jong UwUn (@KawaiiJongUwUn) -
Found on 12 September 2026 by searching the open web for the account handles this site already holds for this operator, and read directly from the page cited. A portfolio site the operator publishes under its own GitHub Pages account, presenting as WILLIAM HARRIS with "10 years of experience of software development and technical writing" and a skills wall running from Solidity to TensorFlow. Its contact block is the useful part, because it gathers in one place identifiers this site held separately and adds two it did not: the address williamharris0214@gmail.com, a second Skype identifier live:.cid.456097f8358a684a, a WhatsApp link and a tel: link both to +1 646 480 0703, a Telegram link to t.me/silvani777, a Discord invite discord.gg/jRrTSsND, a StackOverflow account at stackoverflow.com/users/20988762/william-harris, and — under a page headed William Harris — a LinkedIn link to linkedin.com/in/santiagourregobotero/. The site naming one identity while linking another’s LinkedIn is the page’s own doing, not an inference drawn here. The Discord invite and the StackOverflow account are recorded in this note rather than as indicators of their own: neither has a type in this index, and an invite code is a door rather than an identifier. The second portfolio, portfolio-santiagourregobotero.vercel.app, was read the same day and is the same site with a different person in it. Identical template, identical skills wall down to a duplicated entry for Dart, and a contact block built the same way — but headed SANTIAGO URREGO BOTERO, claiming "over seven years of commercial experience" against the other page’s ten, and a National University of Singapore degree dated 2014 to 2018 against the same university dated 2009 to 2014. What ties the two pages is not the template but the contact details they share: the same Telegram account, t.me/silvani777, and the same Discord invite, discord.gg/jRrTSsND. Each page also carries its own StackOverflow account, its own Gmail address, its own GitHub, and its own Skype identifier, which this site reads as one operator maintaining two complete CVs rather than one identity drifting; that is an inference drawn here, and nothing on either page states it. It also settles a loose end. The telephone number this index holds as +1753362648 is nine subscriber digits where a North American number needs ten, and it was transcribed from a researcher’s chart; this page publishes it twice itself, as tel:+1753362648 and as wa.me/1753362648, so the malformed number is the operator’s own and not a transcription error.
williamharris0214.github.io/https://williamharris0214.github.io/— Chollima Hunter -
Found on 13 September 2026 by probing every account handle this site already holds for this operator against GitLab, and read from the profile cited. An active GitLab account exists under santiagourregobotero, a login the index already carries for this persona on another platform. The profile gives a member-since date of 1 February 2024. It displays "Santiago Urrego Botero", which is a display name rather than a person's name and is recorded here rather than as an alias. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification. The profile's bio, location and links render only in a browser and were not read, so nothing is claimed about them either way.
gitlab.com/santiagourregobotero — Chollima Hunter -
Found on 13 September 2026 by probing every account handle this site already holds for this operator against dev.to, and read from the profile's own public API. An account exists under santiagourregobotero, a login the index already carries for this persona on another platform. It gives a joined date of Oct 22, 2023. It displays "Santiago Urrego Botero", a display name rather than a person's name. The profile links a GitHub account, santiagourregobotero. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
dev.to/santiagourregobotero — Chollima Hunter -
Found on 13 September 2026 by probing every account handle this site already holds for this operator against dev.to, and read from the profile's own public API. An account exists under williamharris0214, a login the index already carries for this persona on another platform. It gives a joined date of Feb 15, 2023. It displays the name William Harris, the same name the reporting already gives. The profile links a GitHub account, williamharris0214. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
dev.to/williamharris0214 — Chollima Hunter -
Found on 17 September 2026 by asking Hugging Face whether an account exists under santiagourregobotero, one of the logins the registry already holds for this operator, and read from the profile cited. The account states a display name of Santiago Urrego Botero. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
huggingface.co/santiagourregobotero — Chollima Hunter -
Read on 20 September 2026 by tallying which GitHub logins have authored commits in the repositories of github.com/williamharris0214, an account already held under this persona. hot214 has authored six of them. It was registered on 12 April 2023, three months after williamharris0214, holds five public repositories, displays the name Silvani, and publishes hot214.dev@gmail.com on its profile, an address this index did not hold. It has no followers and follows two accounts. The handle shares the digits 214 with the account whose repositories it commits in; that is a coincidence of naming, while the address is a value the account states about itself. Two further logins commit in the same repositories, sky-hugger and ddriverdev999, and are recorded nowhere here because nothing beyond the shared repository connects them.
github.com/hot214 — Chollima Hunter
Find this indicator in the index, or see every alias this site holds under Aliases in the browse listing.
Related indicators
Same persona record: William Harris
All 23 on the William Harris page
Cited by the same report: github.com/Kawaii-Jong-UWUn/ITW-Cluster-Research/tree/main/EliteCoder
All 98 indicators from this source